protect against SSH_CLIENT_PUBLIC_KEYS containing term "MYSQLDUMP_ARGS="

CHANGELOG.md

@@ -8,6 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 - `sshd`: no longer accept RSA keys < 2048 bits for authentication
 
+### Fixed
+- protect against `SSH_CLIENT_PUBLIC_KEYS` containing term "MYSQLDUMP_ARGS="
+
 ## [2.0.1] - 2021-06-20
 ### Fixed
 - entrypoint: unset no longer needed `MYSQLDUMP_ARGS` variable

sshd_config

@@ -41,5 +41,6 @@ PermitUserEnvironment no
 PrintMotd no
 PermitTTY no
 
+# > grep: unrecognized option: z
 # .* matches until \0
-ForceCommand exec mysqldump $(grep -o 'MYSQLDUMP_ARGS=.*' /proc/1/environ | cut -d = -f 2-)
+ForceCommand exec mysqldump $(grep -o '^MYSQLDUMP_ARGS=.*' /proc/1/environ | cut -d = -f 2-)